On Tue, Jul 07, 2026 at 10:27:56PM -0700, Christian Huitema wrote:
> I just read Jacob Applebaum's message. Given his description of the
> late-standardization suspicious change that looks like a backdoor in the
> ML-KEM specification, I agree with his conclusion. The WG should not ask for
> publication of the current graph, not until the changes requested by Jacob
> are made.
The removal of whitening of the `m` random input to Encaps is not a
plausible backdoor. If all you have is a broken RNG, you're free to
apply whitening to obtain a new less bad RNG and use that instead.
Nothing stops an ML-KEM implementation from hashing some input (any
number of times, mixing in whatever additional inputs, ...) to produce
its random values. The abstract algorithm starts from the final output
of an adequate RNG that requires no further post-processing.
There's nothing suspicious about this simplification. The critique in
question makes no sense to me. Don't use a broken RNG.
--
Viktor. 🇺🇦 Слава Україні!
_______________________________________________
TLS mailing list -- [email protected]
To unsubscribe send an email to [email protected]
